Taking Control of Cyber-Supply Chain Security
summary
Demonstrates that a single IP stack (Interpeak’s IPNet) spreads the Urgent/11 flaws into VxWorks and Green Hills-based devices — from MRI machines to Airbus A380 systems — and argues that a Software Bill of Materials gives the necessary visibility to act. Recommends concrete formats (SPDX, SWID tag), cites hospital proof‑of‑concepts and a claim of ~100,000 saved man‑hours from better visibility, and prescribes procurement clauses, asking vendors for SBOMs, monitoring dependencies, and running tabletop exercises.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:47Medical Devices
- 6:02Supply Chain
- 11:11Supply Chain Roles
- 14:27Dependency Graph
- 16:57Why
- 17:42Open Source
- 21:28Next Steps
- 22:22Software Updates
- 25:14Monitoring the Supply Chain
- 25:45Software Liability
- 26:29What to do
related talks
37mSecuring OSS across the whole supply chain and beyond
39mSoftware Supply Chain Security
38mChallenge Accepted: 3 Experts, 3 Big Ideas on Supply Chain Security
22mTop 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
40mBuilding Trust in Supply Chains
25mYour Software Supply Chain is Only as Secure as its Weakest Link
21mSecuring Diverse Supply Chains Across Interconnected Systems
36mBuilding a Trusted and Resilient Software Supply Chain